.\search.ps1 peering               # Windows.\search.ps1 sniffer 168.63        # both terms in one line

./search.sh peering                # Linux / Git Bash

python tools/build-html.py

python tools/build-html.pyaz storage blob service-properties update --account-name <sa> --static-website --index-document index.html --auth-mode loginaz storage blob upload --account-name <sa> -c '$web' -f index.html -n index.html --overwrite --auth-mode login --content-type "text/html; charset=utf-8"az storage account show -n <sa> --query "primaryEndpoints.web" -o tsv      # target for the CNAME

az loginaz login --tenant <tenant-id>                       # with several tenantsConnect-AzAccountConnect-AzAccount -Tenant <tenant-id>

az login --use-device-codeaz login --use-device-code --tenant <tenant-id>az login --use-device-code --allow-no-subscriptions  # tenant without subscription (e.g. Entra ID only)Connect-AzAccount -UseDeviceAuthenticationConnect-AzAccount -UseDeviceAuthentication -Tenant <tenant-id>

az login --service-principal `  --username <app-id> `  --password <client-secret> `  --tenant <tenant-id> # better: keep the secret out of the history – prompt instead of typing it$secret = Read-Host "Client secret" -AsSecureString$plain  = [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($secret))az login --service-principal --username <app-id> --password $plain --tenant <tenant-id>Remove-Variable plain # PowerShell (Az module)$cred = Get-Credential -UserName <app-id> -Message "Client secret as password"Connect-AzAccount -ServicePrincipal -Credential $cred -Tenant <tenant-id>

az login --service-principal --username <app-id> --password .\sp-cert.pem --tenant <tenant-id>   # PEM incl. private key (newer CLI: --certificate)Connect-AzAccount -ServicePrincipal -ApplicationId <app-id> -CertificateThumbprint <thumbprint> -Tenant <tenant-id>

az login --identityaz login --identity --username <client-id>          # user-assigned identity (newer CLI: --client-id)Connect-AzAccount -IdentityConnect-AzAccount -Identity -AccountId <client-id>

az account show -o tableGet-AzContextaz logout ; az account clearDisconnect-AzAccount ; Clear-AzContext -Force

$sub = "<subscription-name-or-id>"az account set --subscription $subSet-AzContext -Subscription $subaz account show --query "{name:name, id:id}" -o table(Get-AzContext).Subscription.Name

Get-ChildItem -Recurse *.ps1 | Unblock-File          # remove the download markSet-ExecutionPolicy -Scope Process Bypass            # this session only.\<script>.ps1

az extension add -n resource-graph$part = "<name-part>"az graph query -q "Resources | where name contains '$part' | project name, type, resourceGroup, subscriptionId" -o table# then switch to the right subscriptionaz account set --subscription <subscription-id-from-result>az resource show --ids <resource-id>

$rg = "<rg>"az monitor activity-log list -g $rg --offset 24h `  --query "[?status.value=='Succeeded'].{time:eventTimestamp, who:caller, what:operationName.localizedValue, resource:resourceId}" -o table# deletions onlyaz monitor activity-log list -g $rg --offset 7d `  --query "[?contains(operationName.value,'delete')].{time:eventTimestamp, who:caller, resource:resourceId}" -o table

$rg = "<rg>" ; $loc = "<region>"az group create -n $rg -l $loc --tags Owner=<name> environment=<dev|test|prod> costcenter=<cost-center>az lock create -n lock-$rg -g $rg --lock-type CanNotDelete --notes "Protection against accidental deletion"az group show -n $rg --query tagsaz lock list -g $rg -o table

$rg = "<rg>" ; $vm = "<vm>"# run a command without signing inaz vm run-command invoke -g $rg -n $vm --command-id RunShellScript --scripts "hostname; ip a; ip r" --query "value[0].message" -o tsvaz vm run-command invoke -g $rg -n $vm --command-id RunPowerShellScript --scripts "ipconfig /all" --query "value[0].message" -o tsv# reset password / SSH keyaz vm user update -g $rg -n $vm -u <user> -p <new-password>az vm user update -g $rg -n $vm -u <user> --ssh-key-value "$(Get-Content $HOME\.ssh\id_rsa.pub)"# when nothing else works: boot log and serial consoleaz vm boot-diagnostics enable -g $rg -n $vmaz vm boot-diagnostics get-boot-log -g $rg -n $vmaz extension add -n serial-consoleaz serial-console connect -g $rg -n $vm

$rg = "<rg>"az vm deallocate --ids (az vm list -g $rg --query "[].id" -o tsv) --no-wait     # no compute costsaz vm start      --ids (az vm list -g $rg --query "[].id" -o tsv) --no-waitaz vm list -d -g $rg --query "[].{name:name, state:powerState}" -o table

$loc = "<region>"az vm image list-offers -l $loc -p fortinet --query "[?contains(name,'fortigate')].name" -o tsvaz vm image list-skus   -l $loc -p fortinet -f fortinet_fortigate-vm -o tableaz vm image list -p fortinet -f fortinet_fortigate-vm -s <sku> -l $loc --all --query "[].version" -o tsv$urn = "fortinet:fortinet_fortigate-vm:<sku>:latest"az vm image terms show   --urn $urn --query acceptedaz vm image terms accept --urn $urn

$loc = "<region>" ; $sku = "<vm-size>"az vm list-skus -l $loc --size $sku --query "[].{sku:name, zones:locationInfo[0].zones, restriction:restrictions[0].reasonCode}" -o tableaz vm list-usage -l $loc --query "[?contains(name.value,'Total') || contains(localName,'<family>')].{name:localName, used:currentValue, limit:limit}" -o table

$hubRg   = "<rg-hub>"   ; $hubVnet = "<vnet-hub>"$rg      = "<rg-spoke>" ; $vnet    = "<vnet-spoke>" ; $loc = "<region>"$space   = "10.1.0.0/24" ; $snet = "snet-app" ; $snetPrefix = "10.1.0.0/26"$nvaIp   = "<ilb-ip-of-firewall>" # 1. VNet and subnetaz group create -n $rg -l $locaz network vnet create -g $rg -n $vnet -l $loc --address-prefixes $spaceaz network vnet subnet create -g $rg --vnet-name $vnet -n $snet --address-prefixes $snetPrefix --default-outbound false # 2. Peering in both directions$hubId   = az network vnet show -g $hubRg -n $hubVnet --query id -o tsv$spokeId = az network vnet show -g $rg    -n $vnet    --query id -o tsvaz network vnet peering create -g $rg    --vnet-name $vnet    -n "$vnet-to-$hubVnet" --remote-vnet $hubId   --allow-vnet-access --allow-forwarded-trafficaz network vnet peering create -g $hubRg --vnet-name $hubVnet -n "$hubVnet-to-$vnet" --remote-vnet $spokeId --allow-vnet-access --allow-forwarded-traffic#    with VPN/ER gateway in the hub additionally: hub side --allow-gateway-transit, spoke side --use-remote-gateways # 3. Route table: everything via the firewallaz network route-table create -g $rg -n "rt-$vnet" -l $loc --disable-bgp-route-propagation trueaz network route-table route create -g $rg --route-table-name "rt-$vnet" -n default-to-nva `  --address-prefix 0.0.0.0/0 --next-hop-type VirtualAppliance --next-hop-ip-address $nvaIpaz network vnet subnet update -g $rg --vnet-name $vnet -n $snet --route-table "rt-$vnet" # 4. Checkaz network vnet peering list -g $rg --vnet-name $vnet --query "[].{name:name, state:peeringState, sync:peeringSyncLevel}" -o table

$rg = "<rg>" ; $vnet = "<vnet>"az network vnet update -g $rg -n $vnet --address-prefixes <existing-prefix> <new-prefix>az network vnet peering list -g $rg --vnet-name $vnet --query "[].{name:name, sync:peeringSyncLevel}" -o tableaz network vnet peering sync -g $rg --vnet-name $vnet -n <peering>          # for each peering, status -> FullyInSync

$rg = "<rg>" ; $nsg = "<nsg>"$myIp = Invoke-RestMethod https://api.ipify.orgaz network nsg rule create -g $rg --nsg-name $nsg -n Temp-Allow-MyIp --priority 110 `  --direction Inbound --access Allow --protocol Tcp `  --source-address-prefixes "$myIp/32" --destination-port-ranges 22 443# … work …az network nsg rule delete -g $rg --nsg-name $nsg -n Temp-Allow-MyIp

$rg = "<rg>" ; $vm = "<vm>" ; $nic = "<nic>"az network nic show-effective-route-table -g $rg -n $nic -o table                     # 0.0.0.0/0 -> where?az network watcher show-next-hop -g $rg --vm $vm --source-ip <vm-ip> --dest-ip 8.8.8.8 -o tableaz network nic list-effective-nsg -g $rg -n $nic --query "value[].effectiveSecurityRules[?direction=='Outbound'].{name:name, access:access, prio:priority}"az vm run-command invoke -g $rg -n $vm --command-id RunShellScript --scripts "curl -s -m 5 ifconfig.me; echo"

$rg = "<rg>" ; $app = "<webapp>" ; $vnet = "<vnet>" ; $snet = "<snet-pe>"$rgDns = "<rg-dns>" ; $zone = "privatelink.azurewebsites.net"$dnsVnetId = "<vnet-id-that-resolves-dns>" $appId = az webapp show -g $rg -n $app --query id -o tsvaz network private-endpoint create -g $rg -n "pe-$app" --vnet-name $vnet --subnet $snet `  --private-connection-resource-id $appId --group-id sites --connection-name "pe-$app" # DNS zone (once per environment) and linkaz network private-dns zone create -g $rgDns -n $zoneaz network private-dns link vnet create -g $rgDns -z $zone -n "link-$vnet" -v $dnsVnetId -e false$zoneId = az network private-dns zone show -g $rgDns -n $zone --query id -o tsvaz network private-endpoint dns-zone-group create -g $rg --endpoint-name "pe-$app" -n default `  --private-dns-zone $zoneId --zone-name websites # disable public access and checkaz webapp update -g $rg -n $app --set publicNetworkAccess=Disablednslookup "$app.azurewebsites.net"            # from the VNet: private IP expected

nslookup <name>.privatelink.<zone>                    # or the public name, e.g. <app>.azurewebsites.netaz network vnet show -g <rg> -n <vnet> --query dhcpOptions.dnsServers      # empty = Azure DNSaz network private-dns link vnet list -g <rg-dns> -z <zone> --query "[].{name:name, vnet:virtualNetwork.id}" -o tableaz network private-dns record-set a list -g <rg-dns> -z <zone> --query "[].{name:name, ip:aRecords[0].ipv4Address}" -o tableaz network private-endpoint show -g <rg> -n <pe> --query "customDnsConfigs"

$rg = "<rg>" ; $gw = "<vpn-gateway>" ; $conn = "<connection>"az network vpn-connection show -g $rg -n $conn --query "{status:connectionStatus, in:ingressBytesTransferred, out:egressBytesTransferred}"az network vnet-gateway list-bgp-peer-status -g $rg -n $gw -o tableaz network vnet-gateway list-learned-routes -g $rg -n $gw -o tableaz network vpn-connection shared-key show -g $rg --connection-name $conn       # compare PSK with the remote side

$rg = "<rg-bastion>" ; $bastion = "<bastion>"$vmId = az vm show -g <rg-vm> -n <vm> --query id -o tsv# GUI (HTTPS) -> then in the browser https://localhost:8443az network bastion tunnel -g $rg -n $bastion --target-resource-id $vmId --resource-port 443 --port 8443# SSH -> in a second window: ssh -p 50022 <admin>@127.0.0.1az network bastion tunnel -g $rg -n $bastion --target-resource-id $vmId --resource-port 22 --port 50022# RDP directlyaz network bastion rdp -g $rg -n $bastion --target-resource-id $vmId

$sub      = "<subscription>"$rg       = "<rg-agw>"$agwName  = "<agw-name>"$kvName   = "<keyvault-name>"$certName = "<certificate-name>"           # name in Key Vault and in the App Gateway Set-AzContext -Subscription $sub $AppGW    = Get-AzApplicationGateway -Name $agwName -ResourceGroupName $rg$secret   = Get-AzKeyVaultSecret -VaultName $kvName -Name $certName$secretId = $secret.Id.Replace($secret.Version, "")   # versionless: https://<kv>.vault.azure.net/secrets/<name>/ $AppGW = Add-AzApplicationGatewaySslCertificate -ApplicationGateway $AppGW -Name $certName -KeyVaultSecretId $secretIdSet-AzApplicationGateway -ApplicationGateway $AppGW     # takes a few minutes

az account set --subscription <subscription>$secretId = "https://<keyvault-name>.vault.azure.net/secrets/<certificate-name>"     # without versionaz network application-gateway ssl-cert create -g <rg-agw> --gateway-name <agw-name> `  -n <certificate-name> --key-vault-secret-id $secretIdaz network application-gateway ssl-cert list -g <rg-agw> --gateway-name <agw-name> `  --query "[].{name:name, kv:keyVaultSecretId}" -o table

$id    = Get-AzUserAssignedIdentity -ResourceGroupName <rg> -Name <identity>$AppGW = Get-AzApplicationGateway -Name <agw-name> -ResourceGroupName <rg-agw>Set-AzApplicationGatewayIdentity -ApplicationGateway $AppGW -UserAssignedIdentityId $id.IdSet-AzApplicationGateway -ApplicationGateway $AppGWNew-AzRoleAssignment -ObjectId $id.PrincipalId -RoleDefinitionName "Key Vault Secrets User" `  -Scope (Get-AzKeyVault -VaultName <keyvault-name>).ResourceId

$AppGW    = Get-AzApplicationGateway -Name <agw-name> -ResourceGroupName <rg-agw>$cert     = Get-AzApplicationGatewaySslCertificate -ApplicationGateway $AppGW -Name <certificate-name>$listener = Get-AzApplicationGatewayHttpListener   -ApplicationGateway $AppGW -Name <listener-name>$listener.SslCertificate = $certSet-AzApplicationGateway -ApplicationGateway $AppGW

# Which certificates exist and where do they come from?$AppGW = Get-AzApplicationGateway -Name <agw-name> -ResourceGroupName <rg-agw>$AppGW.SslCertificates | Select Name, KeyVaultSecretId, ProvisioningState # Switch to a new Key Vault source$AppGW = Set-AzApplicationGatewaySslCertificate -ApplicationGateway $AppGW -Name <certificate-name> -KeyVaultSecretId <new-secret-id>Set-AzApplicationGateway -ApplicationGateway $AppGW # Remove a certificate that is no longer used (detach from all listeners first)$AppGW = Remove-AzApplicationGatewaySslCertificate -ApplicationGateway $AppGW -Name <old-name>Set-AzApplicationGateway -ApplicationGateway $AppGW

az keyvault certificate import --vault-name <keyvault-name> -n <certificate-name> -f .\cert.pfx --password <pfx-password>az keyvault certificate show --vault-name <keyvault-name> -n <certificate-name> --query "{expires:attributes.expires, sid:sid}"# PowerShell$pw = Read-Host "PFX password" -AsSecureStringImport-AzKeyVaultCertificate -VaultName <keyvault-name> -Name <certificate-name> -FilePath .\cert.pfx -Password $pw

$rg = "<rg-agw>" ; $agw = "<agw>"az network application-gateway show-backend-health -g $rg -n $agw `  --query "backendAddressPools[].backendHttpSettingsCollection[].servers[].{server:address, health:health, log:healthProbeLog}" -o tableaz network application-gateway http-settings list -g $rg --gateway-name $agw `  --query "[].{name:name, port:port, proto:protocol, host:hostName, pickHost:pickHostNameFromBackendAddress, probe:probe.id}" -o tableaz network application-gateway probe list -g $rg --gateway-name $agw `  --query "[].{name:name, proto:protocol, host:host, path:path, pickHost:pickHostNameFromBackendHttpSettings}" -o table# Does the backend resolve privately? (from a VM in the gateway VNet)nslookup <backend-fqdn>

$rg = "<rg>" ; $policy = "<waf-policy>"# 1. Temporarily only log (if production traffic is being blocked)az network application-gateway waf-policy policy-setting update -g $rg --policy-name $policy --mode Detection --state Enabled

// 2. Which rule, which field? (Log Analytics)AzureDiagnostics| where Category == "ApplicationGatewayFirewallLog" and TimeGenerated > ago(1h)| where requestUri_s contains "<path>"| project TimeGenerated, ruleId_s, Message, details_message_s, details_data_s, requestUri_s

# 3. Exclusion for the affected field (e.g. form field "comment")az network application-gateway waf-policy managed-rule exclusion add -g $rg --policy-name $policy `  --match-variable RequestArgNames --selector-match-operator Equals --selector commentaz network application-gateway waf-policy managed-rule exclusion list -g $rg --policy-name $policy # 4. Switch back to blockingaz network application-gateway waf-policy policy-setting update -g $rg --policy-name $policy --mode Prevention --state Enabled

$resId = az network application-gateway show -g <rg> -n <agw> --query id -o tsv      # any resource$lawId = az monitor log-analytics workspace show -g <rg-law> -n <law> --query id -o tsvaz monitor diagnostic-settings create -n diag-to-law --resource $resId --workspace $lawId `  --logs '[{"categoryGroup":"allLogs","enabled":true}]' --metrics '[{"category":"AllMetrics","enabled":true}]' `  --export-to-resource-specific trueaz monitor diagnostic-settings list --resource $resId -o table

$SPName = "<sp-display-name>"$id = az ad sp list --display-name $SPName --query "[].{id:id}" --output tsv$id                                          # exactly ONE ID? With several SPs of the same name stop and look up by app ID:# $id = az ad sp show --id <app-id> --query id -o tsv # Choose the scope – as small as possible:$scope = "/subscriptions/<subscription-id>"                                       # one subscription# $scope = "/subscriptions/<subscription-id>/resourceGroups/<rg>"                 # one resource group# $scope = "/providers/Microsoft.Management/managementGroups/<mg-id>"             # management group# $scope = "/"                                                                    # tenant root (everything!) az role assignment create --assignee-principal-type ServicePrincipal --assignee-object-id $id --scope $scope --role "Owner"az role assignment list --assignee $id --all --query "[].{role:roleDefinitionName, scope:scope}" -o table

# 1. Elevate your own access on root (Entra ID: "Access management for Azure resources" = Yes)az rest --method post --url "/providers/Microsoft.Authorization/elevateAccess?api-version=2016-07-01"# 2. Assignment as above with --scope "/"az role assignment create --assignee-principal-type ServicePrincipal --assignee-object-id $id --scope "/" --role "Owner"# 3. Remove your own elevation again$me = az ad signed-in-user show --query id -o tsvaz role assignment delete --assignee $me --role "User Access Administrator" --scope "/"

$rg = "<rg>" ; $name = "<identity>"$principalId = az identity create -g $rg -n $name --query principalId -o tsv$scope = az keyvault show -n <keyvault-name> --query id -o tsv          # or RG/subscription/resourceaz role assignment create --assignee-object-id $principalId --assignee-principal-type ServicePrincipal `  --role "Key Vault Secrets User" --scope $scopeaz role assignment list --assignee $principalId --all -o table

$who = az ad signed-in-user show --query id -o tsv          # or: <upn> / <object-id>az role assignment list --assignee $who --all --include-inherited `  --query "[].{role:roleDefinitionName, scope:scope}" -o tableaz ad user get-member-groups --id $who --query "[].displayName" -o tsv     # permissions via groups

# 1. Copy policyAssignmentId / policyDefinitionId from the error message$assignmentId = "<policyAssignmentId>"az policy assignment list --disable-scope-strict-match --scope /subscriptions/<sub>/resourceGroups/<rg> `  --query "[?id=='$assignmentId'].{name:displayName, scope:scope, def:policyDefinitionId}" -o tableaz policy definition show --name <definition-name> --query "{name:displayName, rule:policyRule}"# 2. Make it compliant (preferred) – or a time-limited exemption for the scopeaz policy exemption create -n <name> --policy-assignment $assignmentId `  --scope /subscriptions/<sub>/resourceGroups/<rg> --exemption-category Waiver `  --expires-on 2026-12-31T00:00:00Z --description "<reason, ticket>"

# In Key Vaultaz keyvault certificate list --vault-name <keyvault-name> `  --query "sort_by([].{name:name, expires:attributes.expires}, &expires)" -o table# What a server actually serves (Git Bash / Linux)openssl s_client -connect <host>:443 -servername <host> </dev/null 2>/dev/null | openssl x509 -noout -enddate -subject

# Without openssl, in PowerShell$tcp = New-Object Net.Sockets.TcpClient("<host>", 443)$ssl = New-Object Net.Security.SslStream($tcp.GetStream(), $false, { $true })$ssl.AuthenticateAsClient("<host>")$ssl.RemoteCertificate | Select Subject, @{n='Expires';e={$_.GetExpirationDateString()}}$tcp.Close()

$rg = "rg-tfstate" ; $loc = "<region>" ; $sa = "<sttfstateunique>"     # 3–24 chars, lowercase letters/digits onlyaz group create -n $rg -l $locaz storage account create -g $rg -n $sa -l $loc --sku Standard_ZRS --min-tls-version TLS1_2 --allow-blob-public-access falseaz storage account blob-service-properties update -g $rg --account-name $sa --enable-versioning true$saId = az storage account show -g $rg -n $sa --query id -o tsv$me   = az ad signed-in-user show --query id -o tsvaz role assignment create --assignee-object-id $me --assignee-principal-type User --role "Storage Blob Data Contributor" --scope $saIdaz storage container create --account-name $sa -n tfstate --auth-mode login     # role may take 1–2 minutes

terraform {  backend "azurerm" {    resource_group_name  = "rg-tfstate"    storage_account_name = "<sttfstateunique>"    container_name       = "tfstate"    key                  = "<project>.tfstate"    use_azuread_auth     = true  }}

$env:ARM_SUBSCRIPTION_ID = az account show --query id -o tsvterraform initterraform plan -out tfplan

$env:ARM_TENANT_ID       = "<tenant-id>"$env:ARM_SUBSCRIPTION_ID = "<subscription-id>"$env:ARM_CLIENT_ID       = "<app-id>"$env:ARM_CLIENT_SECRET   = "<client-secret>"terraform initterraform plan -out tfplanterraform apply tfplanRemove-Item Env:ARM_CLIENT_SECRET, Env:ARM_CLIENT_ID      # remove afterwards

# imports.tfimport {  to = azurerm_virtual_network.hub  id = "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Network/virtualNetworks/<vnet>"}

az network vnet show -g <rg> -n <vnet> --query id -o tsv          # get the IDterraform plan -generate-config-out=generated.tf                   # let Terraform generate code# review generated.tf, clean up, move into the right fileterraform plan                                                     # goal: "1 to import, 0 to add, 0 to change, 0 to destroy"terraform apply# then delete the import block (or keep it as documentation)

moved {  from = azurerm_subnet.app  to   = module.spoke.azurerm_subnet.this["app"]}

terraform plan            # must show "has moved to" and NO destroy/createterraform apply

# The lock ID is in the error message ("ID: …")terraform force-unlock <lock-id># If that doesn't work: break the lease on the blobaz storage blob lease break --account-name <sa> -c tfstate -b <project>.tfstate --auth-mode login

terraform plan -refresh-only               # shows what changed outside Terraform# keep the change -> put it into code, then normal plan/apply# revert the change -> normal plan/apply overwrites itterraform plan -detailed-exitcode ; $LASTEXITCODE    # 0 = clean, 2 = differences (e.g. for a scheduled check)

# 1. Raise the version in required_providers (e.g. "~> 4.0" -> "~> 4.20")terraform init -upgradeterraform providers lock -platform=windows_amd64 -platform=linux_amd64terraform plan                             # watch for unexpected changes/replacementsgit add .terraform.lock.hcl ; git commit -m "Update azurerm provider"

$rg = "<rg>"az bicep lint -f main.bicepaz deployment group validate -g $rg -f main.bicep -p main.bicepparamaz deployment group what-if  -g $rg -f main.bicep -p main.bicepparamaz deployment group create   -g $rg -f main.bicep -p main.bicepparam -n "deploy-$(Get-Date -Format yyyyMMdd-HHmm)"# On failure: which resource?az deployment operation group list -g $rg -n <deployment-name> `  --query "[?properties.provisioningState=='Failed'].{res:properties.targetResource.resourceName, error:properties.statusMessage.error.message}" -o table

execute vm-license <FortiFlex-token>          # the FortiGate reboots afterwards# after the rebootget system status | grep -i -E "version|serial|license"diagnose debug vm-print-licenseexecute update-nowdiagnose autoupdate versions | grep -A3 "AV Engine"

config firewall address    edit "net-<spoke>"        set subnet 10.1.0.0 255.255.255.0    nextendconfig router static    edit 0        set dst 10.1.0.0 255.255.255.0        set gateway <first-ip-of-port2-subnet>     # .1 of the internal subnet        set device "port2"    nextendconfig firewall policy    edit 0        set name "<spoke>-to-internet"        set srcintf "port2"        set dstintf "port1"        set srcaddr "net-<spoke>"        set dstaddr "all"        set action accept        set schedule "always"        set service "HTTP" "HTTPS" "DNS"        set nat enable        set logtraffic all    nextend

config firewall policy    edit 0        set name "<spoke-a>-to-<spoke-b>"        set srcintf "port2"        set dstintf "port2"        set srcaddr "net-<spoke-a>"        set dstaddr "net-<spoke-b>"        set action accept        set schedule "always"        set service "<services>"        set nat disable        set logtraffic all    nextend

config firewall vip    edit "vip-<service>"        set extip <private-ip-of-port1>       # or LB frontend IP with floating IP        set extintf "port1"        set portforward enable        set mappedip "<internal-server-ip>"        set extport 443        set mappedport 443    nextendconfig firewall policy    edit 0        set name "in-<service>"        set srcintf "port1"        set dstintf "port2"        set srcaddr "all"        set dstaddr "vip-<service>"        set action accept        set schedule "always"        set service "HTTPS"        set logtraffic all    nextend

# 1. Does it arrive and does it leave?diagnose sniffer packet any 'host <ip>' 4 20 # 2. Why is it dropped?diagnose debug resetdiagnose debug flow filter cleardiagnose debug flow filter addr <ip>diagnose debug flow show function-name enablediagnose debug flow trace start 10diagnose debug enable#    (generate traffic)diagnose debug disablediagnose debug reset # 3. Cross-check route and policyget router info routing-table details <dest-ip>show firewall policy | grep -i -A20 <name>

while ($true) { "$((Get-Date).ToString('HH:mm:ss')) $(curl.exe -s -m 2 https://api.ipify.org)"; Start-Sleep 1 }

get system ha statusdiagnose sys ha checksum cluster          # in sync before?execute ha failover set 1                 # trigger failover# … watch the continuous test (interruption in seconds, possibly a new public IP)execute ha failover unset 1diagnose sys ha reset-uptime              # with override disable: hand back the role

diagnose sys ha checksum cluster              # compare on bothdiagnose sys ha checksum show                 # which area differs?execute ha manage <index> <admin>             # switch to the secondaryexecute ha synchronize startdiagnose sys ha checksum recalculate          # if still differentget system ha status

get vpn ipsec tunnel summarydiagnose vpn ike log filter cleardiagnose vpn ike log filter rem-addr4 <peer-ip>diagnose debug application ike -1diagnose debug console timestamp enablediagnose debug enablediagnose vpn tunnel up <phase2> <phase1>      # trigger negotiation# … read the output …diagnose debug disablediagnose debug resetdiagnose vpn tunnel list name <phase1>        # SAs/counters once it is up

config system global    set admin-scp enableend

scp <admin>@<mgmt-ip>:sys_config ".\fgt-backup-$(Get-Date -Format yyyyMMdd).conf"

sudo apt update && sudo apt install -y nginxecho "ok $(hostname) $(hostname -I)" | sudo tee /var/www/html/index.htmlsudo systemctl enable --now nginxcurl -s localhostsudo ufw allow 80/tcp 2>/dev/null || true

d=<service>sudo systemctl status $d --no-pagersudo journalctl -u $d -n 50 --no-pagersudo systemctl restart $d && sudo systemctl is-active $dsudo ss -tlnp | grep -i $d                  # is it listening?

df -hsudo du -xh / --max-depth=1 2>/dev/null | sort -h | tail -10sudo du -xh /var/log --max-depth=1 | sort -h | tailsudo journalctl --vacuum-size=200Msudo apt clean

$target = "<host-or-ip>" ; $port = 443Resolve-DnsName $target                                        # 1. DNSFind-NetRoute -RemoteIPAddress (Resolve-DnsName $target -Type A)[0].IPAddress | Select -Last 1   # 2. routeTest-NetConnection $target -Port $port                         # 3. portcurl.exe -v -m 10 "https://$target"                            # 4. TLS/HTTP

# 1. Generate a key (Azure DevOps only accepts RSA)ssh-keygen -t rsa -b 4096 -f $HOME\.ssh\id_rsa # 2. Copy the public key -> Azure DevOps: top right User settings -> SSH public keys -> + New Key -> pasteGet-Content $HOME\.ssh\id_rsa.pub | Set-Clipboard # 3. Remove an old, possibly broken SSH config (optional)Remove-Item $HOME\.ssh\config -ErrorAction SilentlyContinue # 4. Test the connection – answer "Shell access is not supported" = OKssh -T git@ssh.dev.azure.com # 5. Connect the repo and pushgit remote add origin git@ssh.dev.azure.com:v3/<org>/<project>/<repo>git push -u origin main

cd <folder>git init -b maingit add .git status                                   # no tfstate, tfvars, pfx, licenses?git commit -m "Initial commit"git remote add origin https://dev.azure.com/<org>/<project>/_git/<repo>git push -u origin main                      # sign in via browser or PAT as password

git stash -u                               # park current workgit switch main ; git pullgit switch -c fix/<name># … change …git add -A ; git commit -m "<message>" ; git push -u origin fix/<name>git switch <old-branch>git stash pop                              # continue working

git switch main ; git pullgit switch -c feature/<name># … change …git add -Agit commit -m "<what and why>"git push -u origin feature/<name>az repos pr create --source-branch feature/<name> --target-branch main --title "<title>" --open# after the mergegit switch main ; git pullgit branch -d feature/<name>

git pull                                   # reports CONFLICTgit status                                 # affected files# open the file, keep the right version between <<<<<<< ======= >>>>>>>, delete the markersgit add <file>git commit                                 # or git rebase --continuegit push# abort everything:git merge --abort

# NOT pushed yetgit reset --soft HEAD~1                    # undo the commit, files staygit restore --staged <file>Add-Content .gitignore "<file-or-pattern>"git add -A ; git commit -m "<message>" # Already pushed# 1. Change/revoke the secret IMMEDIATELY (Key Vault, app registration, PAT …)# 2. Remove the file from the repogit rm --cached <file>Add-Content .gitignore "<file-or-pattern>"git commit -m "Remove secret file" ; git push

cd C:\Git                                               # folder where the repo should gogit clone git@ssh.dev.azure.com:v3/<org>/<project>/<repo>         # via SSH (key registered in DevOps)git clone https://dev.azure.com/<org>/<project>/_git/<repo>       # via HTTPS (browser sign-in / PAT)cd <repo>git branch -a                                           # which branches exist? (e.g. main, Dev)git switch Dev                                          # switch to the working branch

az extension add -n azure-devopsaz devops configure --defaults organization=https://dev.azure.com/<org> project=<project>az repos list --query "[].{name:name, ssh:sshUrl, https:remoteUrl}" -o table

cd <your-folder>git init -b main                                        # only if there is no .git folder yetgit remote add origin git@ssh.dev.azure.com:v3/<org>/<project>/<repo>git pull origin main --allow-unrelated-histories        # only needed if the repo already has commitsgit add -A ; git commit -m "<message>"git push -u origin main                                 # with protected main: feature branch + PR (see below)

git switch Dev ; git pull                               # get the latest stategit switch -c feature/<name>                            # own branch# … change …git add -Agit commit -m "<what and why>"git push -u origin feature/<name>

az repos pr create --organization https://dev.azure.com/<org> --project <project> --repository <repo> `  --source-branch feature/<name> --target-branch Dev --title "<title>" --open

git switch Dev ; git pullgit branch -d feature/<name>                            # clean up the local feature branch

! [remote rejected] Dev -> Dev (TF402455: Pushes to this branch are not permitted; you must use a pull request to update this branch.)

git switch -c feature/<name>                            # new branch from the current state – commits come alonggit push -u origin feature/<name>                       # this is allowedgit log --oneline origin/feature/<name> -3              # check: your commits are on the server# then create PR feature/<name> -> Dev (see above) # bring local Dev back to the server stategit switch Devgit fetch origingit reset --hard origin/Dev

git switch feature/<name>git fetch origingit merge origin/Dev                                    # reports CONFLICTgit status                                              # affected files ("both modified")code .                                                  # in VS Code: Accept Current / Incoming / Both

<<<<<<< HEADparam location = 'westeurope'        ← your version=======param location = 'austriaeast'       ← version from Dev>>>>>>> origin/Dev

git add <file>                                          # for each resolved filegit commit                                              # merge commitgit push                                                # the PR updates automaticallygit merge --abort                                       # instead: abort everything

az repos pr list --organization https://dev.azure.com/<org> --project <project> -o table      # PR numberaz repos pr update --id <pr-number> --status abandoned --organization https://dev.azure.com/<org>

git merge --abort                                       # if in the middle of a conflict mergegit switch Devgit fetch origingit reset --hard origin/Dev                             # local Dev = server stategit branch -D feature/<name>                            # delete feature branch locally (only if no longer needed)git push origin --delete feature/<name>                 # and on the server

git fetch origingit log --oneline origin/main..origin/Dev               # commits in Dev that are not in main yetgit diff --stat origin/main...origin/Dev                # changed files

az repos pr create --organization https://dev.azure.com/<org> --project <project> --repository <repo> `  --source-branch Dev --target-branch main --title "Release: Dev to main" --open

git switch Dev ; git pullgit switch -c merge/main-into-devgit merge origin/main                                   # resolve conflicts as abovegit add -A ; git commitgit push -u origin merge/main-into-dev                  # PR to Dev -> afterwards Dev -> main is conflict-free

Get-Command *route*                         # find a commandGet-Help Test-NetConnection -Examples       # examplesGet-History ; Invoke-History <nr>           # history(Get-PSReadLineOption).HistorySavePath      # file with the full history (old sessions too)Select-String -Path (Get-PSReadLineOption).HistorySavePath -Pattern "<text>"     # search the history<command> | Set-Clipboard                   # output to the clipboard<command> | Out-GridView                    # table with filter (Windows)<command> | Export-Csv .\out.csv -NoTypeInformation -Encoding UTF8<command> | ConvertTo-Json -Depth 5 | Set-Content .\out.json<command> | Select-Object -First 5<command> | Where-Object Name -like "*<part>*"<command> | Format-Table -AutoSizeMeasure-Command { <command> }               # measure runtimeStart-Transcript .\session.log ; Stop-Transcript     # record the whole sessioncode .                                      # open the current folder in VS Codeexplorer .                                  # open in Explorerwinget upgrade --all                        # update all tools (az, terraform, git …)

# --- Azure ---function azsub {                         # pick a subscription in a window for CLI and PowerShell    $s = az account list --query "[].{Name:name, Id:id}" -o json | ConvertFrom-Json |         Out-GridView -Title "Choose subscription" -OutputMode Single    if ($s) { az account set --subscription $s.Id; Set-AzContext -Subscription $s.Id | Out-Null; "Active: $($s.Name)" }}function azwho { az account show --query "{user:user.name, sub:name, tenant:tenantId}" -o table } # --- Terraform ---Set-Alias tf terraformfunction tfi { terraform init @args }function tfp { terraform plan -out tfplan @args }function tfa { terraform apply tfplan }function tfs { param($part) terraform state list | Select-String $part } # --- Git ---function gst { git status -s }function glg { git log --oneline --graph --decorate -15 }function gpush { param([string]$msg) git add -A; git commit -m $msg; git push } # --- Network ---function myip { Invoke-RestMethod https://api.ipify.org }function port { param($target, [int]$p) Test-NetConnection $target -Port $p -WarningAction SilentlyContinue |                Select ComputerName, RemoteAddress, RemotePort, TcpTestSucceeded }function dns  { param($name) Resolve-DnsName $name -DnsOnly | Select Name, Type, IPAddress, NameHost } # --- Search Codex ---function cmds { & "<path-to-repo>\search.ps1" @args }

# Recent changes in the affected environmentaz monitor activity-log list -g <rg> --offset 4h `  --query "[?status.value=='Succeeded'].{time:eventTimestamp, who:caller, what:operationName.localizedValue}" -o table # State of the most important resourcesaz vm list -d -g <rg> --query "[].{name:name, state:powerState}" -o tableaz network application-gateway show-backend-health -g <rg> -n <agw> `  --query "backendAddressPools[].backendHttpSettingsCollection[].servers[].{server:address, health:health}" -o table

# 1. DNSResolve-DnsName <name>                                            # right IP? private or public? # 2. Port from the clientTest-NetConnection <target> -Port <port> # 3. Route from Azure's point of viewaz network watcher show-next-hop -g <rg> --vm <source-vm> --source-ip <source-ip> --dest-ip <target-ip> -o tableaz network nic show-effective-route-table -g <rg> -n <nic> -o table # 4. NSGaz network watcher test-ip-flow -g <rg> --vm <vm> --direction Inbound --protocol TCP --local <vm-ip>:<port> --remote <source>:12345

get system status                                   # running, license ok?get system ha status                                # did a failover happen?diagnose sniffer packet any 'host <target-ip>' 4 20 # does traffic arrive and leave?# if it doesn't leave -> debug flow (why dropped):diagnose debug flow filter addr <target-ip>diagnose debug flow trace start 10diagnose debug enablediagnose debug disable ; diagnose debug reset

ss -tlnp | grep <port>                   # is the service listening?sudo systemctl status <service>sudo journalctl -u <service> -n 50

az version                                         # installed versionaz upgrade                                         # update the CLIaz login                                           # browser sign-inaz login --tenant <tenant-id>                      # specific tenantaz login --use-device-code                         # sign in with a code (other device)az login --use-device-code --tenant <tenant-id>az login --allow-no-subscriptions                  # tenant without subscriptionaz login --identity                                # managed identity (Azure VM/pipeline)az login --service-principal --username <app-id> --password <secret> --tenant <tenant-id>   # workflow: 00-workflows.mdaz account show -o table                           # current subscriptionaz account list -o table                           # all subscriptionsaz account list --all -o table                     # incl. disabled onesaz account set --subscription <name-or-id>         # switch subscriptionaz account list --query "[?name=='<name>'].id" -o tsvaz account tenant list -o tableaz logout ; az account clear                       # sign out, clear cacheaz config set core.output=table                    # default outputaz extension list -o tableaz extension add -n <name>                         # e.g. serial-console, resource-graphaz extension update -n <name>az provider register -n Microsoft.Network          # register a resource provideraz provider show -n Microsoft.Network --query registrationState

-o table | tsv | json | jsonc | yaml | none--query "[].{name:name, rg:resourceGroup}"         # choose columns--query "[?location=='austriaeast'].name"          # filter--query "[?contains(name,'<part>')].name"          # contains--query "[?tags.environment=='prod']"              # filter by tag--query "length(@)"                                # count--query "[0].id"                                   # first element$id = az <...> --query id -o tsv                   # value into a variable (PowerShell)id=$(az <...> --query id -o tsv)                   # value into a variable (Bash)--debug                                            # show REST calls (troubleshooting)

az group list -o tableaz group create -n <rg> -l <region> --tags Owner=<x> environment=<y>az group delete -n <rg> --yes --no-waitaz resource list -g <rg> -o tableaz resource list --tag environment=<y> -o tableaz resource show --ids <resource-id>az resource tag --ids <resource-id> --tags key=value -i       # -i = keep existing tagsaz resource delete --ids <resource-id>az resource move --destination-group <rg-new> --ids <id1> <id2>az lock list -g <rg> -o tableaz lock create -n <name> -g <rg> --lock-type CanNotDeleteaz lock delete -n <name> -g <rg> # Availability / regionaz account list-locations --query "[].{name:name, display:displayName}" -o tableaz vm list-skus -l <region> --size <sku> -o table

az extension add -n resource-graphaz graph query -q "Resources | where name contains '<part>' | project name, type, resourceGroup, subscriptionId"az graph query -q "Resources | where type =~ 'microsoft.network/virtualnetworks' | project name, resourceGroup, properties.addressSpace.addressPrefixes"az graph query -q "Resources | where type =~ 'microsoft.network/publicipaddresses' | project name, ip=properties.ipAddress, resourceGroup"az graph query -q "Resources | summarize Count=count() by type | order by Count desc"az graph query -q "ResourceContainers | where type =~ 'microsoft.resources/subscriptions' | project name, subscriptionId"

az vm list -d -o tableaz vm list -d -g <rg> --query "[].{name:name, state:powerState, zone:zones[0], ip:privateIps, pip:publicIps}" -o tableaz vm show -g <rg> -n <vm> --query "{size:hardwareProfile.vmSize, zones:zones, image:storageProfile.imageReference}"az vm get-instance-view -g <rg> -n <vm> --query "instanceView.statuses[].displayStatus"az vm start      -g <rg> -n <vm>az vm stop       -g <rg> -n <vm>                 # stopped, compute still billedaz vm deallocate -g <rg> -n <vm> --no-wait       # deallocated, no compute costsaz vm restart    -g <rg> -n <vm>az vm resize     -g <rg> -n <vm> --size <sku>az vm list-sizes -l <region> -o tableaz vm list-skus  -l <region> --size <sku> --query "[].locationInfo[].zones" -o tsv     # zonesaz vm list-usage -l <region> -o table                                                   # quotaaz vm run-command invoke -g <rg> -n <vm> --command-id RunShellScript --scripts "hostname; ip a"az vm run-command invoke -g <rg> -n <vm> --command-id RunPowerShellScript --scripts "ipconfig /all"az vm boot-diagnostics enable -g <rg> -n <vm>az vm boot-diagnostics get-boot-log -g <rg> -n <vm>az serial-console connect -g <rg> -n <vm>        # extension serial-consoleaz vm user update -g <rg> -n <vm> -u <user> -p <new-password>        # reset passwordaz vm user update -g <rg> -n <vm> -u <user> --ssh-key-value "<public-key>"az vm disk attach -g <rg> --vm-name <vm> --name <disk> --new --size-gb 32az vm extension list -g <rg> --vm-name <vm> -o tableaz vm identity assign -g <rg> -n <vm>            # system-assigned identity # NICaz network nic list -g <rg> -o tableaz network nic show -g <rg> -n <nic> --query "{ip:ipConfigurations[].privateIPAddress, fwd:enableIPForwarding, accel:enableAcceleratedNetworking}"az network nic update -g <rg> -n <nic> --ip-forwarding true          # required for NVAs

az vm image list-publishers -l <region> --query "[?contains(name,'<part>')].name" -o tsvaz vm image list-offers -l <region> -p <publisher> -o tableaz vm image list-skus   -l <region> -p <publisher> -f <offer> -o tableaz vm image list -p <publisher> -f <offer> -s <sku> -l <region> --all -o tableaz vm image terms show   --urn <publisher>:<offer>:<sku>:<version>az vm image terms accept --urn <publisher>:<offer>:<sku>:<version>

az webapp list --query "[].{name:name, rg:resourceGroup, state:state, host:defaultHostName}" -o tableaz webapp show -g <rg> -n <app> --query "{state:state, https:httpsOnly, pna:publicNetworkAccess, vnet:virtualNetworkSubnetId}"az webapp restart -g <rg> -n <app>az webapp log tail -g <rg> -n <app>                                  # live logaz webapp config appsettings list -g <rg> -n <app> -o tableaz webapp config appsettings set  -g <rg> -n <app> --settings KEY=valueaz webapp config access-restriction show -g <rg> -n <app>az webapp vnet-integration list -g <rg> -n <app>az webapp update -g <rg> -n <app> --set publicNetworkAccess=Disabledaz functionapp list -o table

az storage account list --query "[].{name:name, rg:resourceGroup, sku:sku.name, pna:publicNetworkAccess}" -o tableaz storage account show -g <rg> -n <sa> --query "{tls:minimumTlsVersion, public:allowBlobPublicAccess, key:allowSharedKeyAccess}"az storage account network-rule list -g <rg> --account-name <sa>az storage account update -g <rg> -n <sa> --default-action Denyaz storage container list --account-name <sa> --auth-mode login -o tableaz storage blob list   --account-name <sa> -c <container> --auth-mode login -o tableaz storage blob upload --account-name <sa> -c <container> -f <file> -n <name> --auth-mode loginaz storage blob download --account-name <sa> -c <container> -n <name> -f <target> --auth-mode login

az aks list -o tableaz aks get-credentials -g <rg> -n <aks>              # get kubeconfigaz aks show -g <rg> -n <aks> --query "{k8s:kubernetesVersion, net:networkProfile.networkPlugin, outbound:networkProfile.outboundType}"kubectl get nodes -o wide ; kubectl get pods -A

az monitor activity-log list -g <rg> --offset 2h `  --query "[].{time:eventTimestamp, op:operationName.localizedValue, status:status.value, by:caller}" -o tableaz monitor activity-log list --correlation-id <id>az monitor diagnostic-settings list --resource <resource-id> -o tableaz monitor diagnostic-settings categories list --resource <resource-id> -o tableaz monitor diagnostic-settings create -n <name> --resource <resource-id> --workspace <law-id> `  --logs '[{"categoryGroup":"allLogs","enabled":true}]' --metrics '[{"category":"AllMetrics","enabled":true}]'az monitor log-analytics workspace list -o tableaz monitor log-analytics workspace show -g <rg> -n <law> --query customerId -o tsv     # workspace GUIDaz monitor log-analytics query -w <workspace-guid> --analytics-query "<KQL>" -o tableaz monitor metrics list-definitions --resource <resource-id> -o tableaz monitor metrics list --resource <resource-id> --metric <name> --interval PT5M -o tableaz monitor metrics alert list -g <rg> -o table

az account get-access-token --query accessToken -o tsvaz rest --method get --url "https://management.azure.com/subscriptions/<sub>/resourceGroups?api-version=2021-04-01"az rest --method get --url "<resource-id>?api-version=<version>"     # raw resource as JSON

az network vnet list --query "[].{name:name, rg:resourceGroup, space:addressSpace.addressPrefixes[0]}" -o tableaz network vnet show -g <rg> -n <vnet> --query "{space:addressSpace.addressPrefixes, dns:dhcpOptions.dnsServers}"az network vnet create -g <rg> -n <vnet> --address-prefixes 10.0.0.0/22 -l <region>az network vnet update -g <rg> -n <vnet> --address-prefixes 10.0.0.0/22 10.0.8.0/24     # extend address spaceaz network vnet update -g <rg> -n <vnet> --dns-servers <ip1> <ip2>                       # custom DNSaz network vnet update -g <rg> -n <vnet> --dns-servers ""                                # back to Azure DNSaz network vnet subnet list -g <rg> --vnet-name <vnet> `  --query "[].{name:name, prefix:addressPrefix, nsg:networkSecurityGroup.id, rt:routeTable.id}" -o tableaz network vnet subnet create -g <rg> --vnet-name <vnet> -n <subnet> --address-prefixes 10.0.1.0/24 `  --default-outbound falseaz network vnet subnet update -g <rg> --vnet-name <vnet> -n <subnet> --network-security-group <nsg>az network vnet subnet update -g <rg> --vnet-name <vnet> -n <subnet> --route-table <rt-id>az network vnet subnet update -g <rg> --vnet-name <vnet> -n <subnet> --remove routeTableaz network vnet subnet update -g <rg> --vnet-name <vnet> -n <subnet> --remove networkSecurityGroupaz network vnet subnet update -g <rg> --vnet-name <vnet> -n <subnet> --private-endpoint-network-policies Enabledaz network vnet subnet update -g <rg> --vnet-name <vnet> -n <subnet> --delegations Microsoft.Web/serverFarmsaz network vnet list-available-ips -g <rg> -n <vnet>az network vnet check-ip-address -g <rg> -n <vnet> --ip-address <ip>       # free?

az network vnet peering list -g <rg> --vnet-name <vnet> `  --query "[].{name:name, state:peeringState, sync:peeringSyncLevel, access:allowVirtualNetworkAccess, fwd:allowForwardedTraffic, gwTransit:allowGatewayTransit, remoteGw:useRemoteGateways}" -o tableaz network vnet peering create -g <rg> --vnet-name <vnet-a> -n <a-to-b> --remote-vnet <vnet-b-id> `  --allow-vnet-access --allow-forwarded-trafficaz network vnet peering update -g <rg> --vnet-name <vnet> -n <peering> --set allowForwardedTraffic=trueaz network vnet peering sync -g <rg> --vnet-name <vnet> -n <peering>       # after an address space changeaz network vnet peering delete -g <rg> --vnet-name <vnet> -n <peering>

az network route-table list -o tableaz network route-table create -g <rg> -n <rt> -l <region> --disable-bgp-route-propagation trueaz network route-table route create -g <rg> --route-table-name <rt> -n default-to-nva `  --address-prefix 0.0.0.0/0 --next-hop-type VirtualAppliance --next-hop-ip-address <nva-or-ilb-ip>az network route-table route list -g <rg> --route-table-name <rt> -o tableaz network route-table route update -g <rg> --route-table-name <rt> -n <route> --next-hop-ip-address <new-ip>az network route-table route delete -g <rg> --route-table-name <rt> -n <route>az network route-table show -g <rg> -n <rt> --query "subnets[].id" -o tsv        # where is it associated?

az network nic show-effective-route-table -g <rg> -n <nic> -o tableaz network nic list-effective-nsg -g <rg> -n <nic>az network watcher show-next-hop -g <rg> --vm <vm> --source-ip <vm-ip> --dest-ip <target> -o tableaz network watcher test-connectivity -g <rg> --source-resource <vm> --dest-address <target> --dest-port 443az network watcher test-ip-flow -g <rg> --vm <vm> --direction Inbound --protocol TCP `  --local <vm-ip>:443 --remote <source>:12345az network watcher list -o table                                   # Network Watcher per region

az network nsg list -o tableaz network nsg create -g <rg> -n <nsg>az network nsg rule list -g <rg> --nsg-name <nsg> --include-default -o tableaz network nsg rule create -g <rg> --nsg-name <nsg> -n Allow-Https-In --priority 100 `  --direction Inbound --access Allow --protocol Tcp `  --source-address-prefixes <source-or-ServiceTag> --destination-port-ranges 443az network nsg rule update -g <rg> --nsg-name <nsg> -n <rule> --access Denyaz network nsg rule delete -g <rg> --nsg-name <nsg> -n <rule>az network nsg show -g <rg> -n <nsg> --query "{subnets:subnets[].id, nics:networkInterfaces[].id}"

az network nat gateway list -o tableaz network nat gateway create -g <rg> -n <natgw> --public-ip-addresses <pip> --idle-timeout 4az network vnet subnet update -g <rg> --vnet-name <vnet> -n <subnet> --nat-gateway <natgw>az network bastion list -o tableaz network bastion ssh -g <rg> -n <bastion> --target-resource-id <vm-id> --auth-type ssh-key --username <user> --ssh-key <path>az network bastion rdp -g <rg> -n <bastion> --target-resource-id <vm-id>az network bastion tunnel -g <rg> -n <bastion> --target-resource-id <vm-id> --resource-port 22 --port 50022

az network vnet-gateway list -g <rg> -o tableaz network vnet-gateway show -g <rg> -n <gw> --query "{sku:sku.name, bgp:bgpSettings, ips:ipConfigurations[].publicIPAddress.id}"az network vnet-gateway list-bgp-peer-status -g <rg> -n <gw> -o tableaz network vnet-gateway list-learned-routes  -g <rg> -n <gw> -o tableaz network vnet-gateway list-advertised-routes -g <rg> -n <gw> --peer <bgp-peer-ip> -o tableaz network vnet-gateway reset -g <rg> -n <gw>                       # restart the instance(s)az network local-gateway list -g <rg> -o tableaz network vpn-connection list -g <rg> --query "[].{name:name, status:connectionStatus, type:connectionType}" -o tableaz network vpn-connection show -g <rg> -n <conn> --query "{status:connectionStatus, in:ingressBytesTransferred, out:egressBytesTransferred}"az network vpn-connection shared-key show  -g <rg> --connection-name <conn>az network vpn-connection shared-key update -g <rg> --connection-name <conn> --value <psk>

az extension add -n azure-firewallaz network firewall list -o tableaz network firewall show -g <rg> -n <fw> --query "{ip:ipConfigurations[0].privateIPAddress, policy:firewallPolicy.id}"az network firewall policy list -o tableaz network firewall policy rule-collection-group list -g <rg> --policy-name <policy> --query "[].{name:name, prio:priority}" -o tableaz network firewall policy rule-collection-group show -g <rg> --policy-name <policy> -n <rcg> `  --query "ruleCollections[].{name:name, prio:priority, action:action.type, rules:length(rules)}" -o table # Add a rule to an existing collectionaz network firewall policy rule-collection-group collection rule add -g <rg> --policy-name <policy> --rcg-name <rcg> `  --collection-name <collection> --name <rule> --rule-type NetworkRule `  --source-addresses 10.1.0.0/24 --destination-addresses 10.2.0.0/24 --destination-ports 443 --ip-protocols TCP # New collection with a ruleaz network firewall policy rule-collection-group collection add-filter-collection -g <rg> --policy-name <policy> --rcg-name <rcg> `  --name <collection> --collection-priority 200 --action Allow --rule-name <rule> --rule-type ApplicationRule `  --source-addresses 10.1.0.0/24 --target-fqdns "*.microsoft.com" --protocols Https=443 # Remove a ruleaz network firewall policy rule-collection-group collection rule remove -g <rg> --policy-name <policy> --rcg-name <rcg> `  --collection-name <collection> --name <rule>

$pol  = Get-AzFirewallPolicy -Name <policy> -ResourceGroupName <rg>$rcg  = Get-AzFirewallPolicyRuleCollectionGroup -Name <rcg> -AzureFirewallPolicyName <policy> -ResourceGroupName <rg>$rule = ($rcg.Properties.RuleCollection | Where-Object Name -eq "<collection>").Rules | Where-Object Name -eq "<rule>"$rule.DestinationAddresses.Add("10.3.0.0/24")Set-AzFirewallPolicyRuleCollectionGroup -Name <rcg> -Priority $rcg.Properties.Priority `  -RuleCollection $rcg.Properties.RuleCollection -FirewallPolicyObject $pol

az network private-dns zone list -o tableaz network private-dns zone create -g <rg> -n privatelink.azurewebsites.netaz network private-dns link vnet list -g <rg-dns> -z <zone> -o tableaz network private-dns link vnet create -g <rg-dns> -z <zone> -n <link-name> -v <vnet-id> -e false   # -e = auto-registrationaz network private-dns record-set a list -g <rg-dns> -z <zone> -o tableaz network private-dns record-set a add-record -g <rg-dns> -z <zone> -n <name> -a <ip>az network private-dns record-set a remove-record -g <rg-dns> -z <zone> -n <name> -a <ip> az network private-endpoint list -g <rg> -o tableaz network private-endpoint show -g <rg> -n <pe> --query "customDnsConfigs"az network private-endpoint create -g <rg> -n <pe> --vnet-name <vnet> --subnet <subnet> `  --private-connection-resource-id <target-resource-id> --group-id <sites|vault|blob|...> --connection-name <name>az network private-endpoint dns-zone-group create -g <rg> --endpoint-name <pe> -n default `  --private-dns-zone <zone-id> --zone-name <zone>az network private-endpoint-connection list --id <target-resource-id> -o tableaz network private-endpoint-connection approve --id <connection-id> --description "ok" # DNS Private Resolveraz dns-resolver list -o tableaz dns-resolver inbound-endpoint list -g <rg> --dns-resolver-name <resolver> -o tableaz dns-resolver forwarding-ruleset list -g <rg> -o table

az network application-gateway list -o tableaz network application-gateway show -g <rg> -n <agw> --query "{state:operationalState, sku:sku.name}"az network application-gateway show-backend-health -g <rg> -n <agw> `  --query "backendAddressPools[].backendHttpSettingsCollection[].servers[].{server:address, health:health, log:healthProbeLog}" -o tableaz network application-gateway stop  -g <rg> -n <agw>az network application-gateway start -g <rg> -n <agw>az network application-gateway http-listener list -g <rg> --gateway-name <agw> -o tableaz network application-gateway rule list -g <rg> --gateway-name <agw> -o tableaz network application-gateway address-pool list -g <rg> --gateway-name <agw> -o tableaz network application-gateway http-settings list -g <rg> --gateway-name <agw> -o tableaz network application-gateway probe list -g <rg> --gateway-name <agw> -o tableaz network application-gateway ssl-cert list -g <rg> --gateway-name <agw> -o tableaz network application-gateway ssl-cert create -g <rg> --gateway-name <agw> -n <name> `  --key-vault-secret-id https://<kv>.vault.azure.net/secrets/<name>      # certificate from Key Vaultaz network application-gateway identity show -g <rg> --gateway-name <agw> # WAF policiesaz network application-gateway waf-policy list -g <rg> -o tableaz network application-gateway waf-policy show -g <rg> -n <policy> `  --query "{mode:policySettings.mode, state:policySettings.state, sets:managedRules.managedRuleSets[].{t:ruleSetType,v:ruleSetVersion}}"az network application-gateway waf-policy policy-setting update -g <rg> --policy-name <policy> --mode Prevention --state Enabledaz network application-gateway waf-policy managed-rule rule-set list -g <rg> --policy-name <policy>az network application-gateway waf-policy managed-rule rule-set add -g <rg> --policy-name <policy> `  --type Microsoft_BotManagerRuleSet --version 1.1az network application-gateway waf-policy managed-rule exclusion list -g <rg> --policy-name <policy>az network application-gateway waf-policy custom-rule list -g <rg> --policy-name <policy> -o table

az network lb list -o tableaz network lb show -g <rg> -n <lb> --query "{fe:frontendIPConfigurations[].privateIPAddress, sku:sku.name}"az network lb rule list -g <rg> --lb-name <lb> -o tableaz network lb probe list -g <rg> --lb-name <lb> -o tableaz network lb address-pool list -g <rg> --lb-name <lb> -o tableaz network lb outbound-rule list -g <rg> --lb-name <lb> -o tableaz network lb inbound-nat-rule list -g <rg> --lb-name <lb> -o table az network public-ip list -g <rg> --query "[].{name:name, ip:ipAddress, sku:sku.name, zones:zones, on:ipConfiguration.id}" -o tableaz network public-ip create -g <rg> -n <pip> --sku Standard --allocation-method Static --zone 1 2 3

az network watcher flow-log list -l <region> -o tableaz network watcher flow-log show -l <region> -n <flowlog>

Profile (Standard / Premium)└── Endpoint                 <name>-<hash>.z01.azurefd.net    └── Route                which domains + paths -> which origin group        ├── Custom domains   app.company.tld (+ certificate)        └── Origin group     health probe, load balancing            └── Origins      e.g. <app>.azurewebsites.net (priority, weight, optional Private Link)

$rg = "<rg-afd>" ; $afd = "<afd-profile>" ; $ep = "<afd-endpoint>"az afd profile list --query "[].{name:name, rg:resourceGroup, sku:sku.name}" -o tableaz afd endpoint list -g $rg --profile-name $afd --query "[].{name:name, host:hostName}" -o tableaz afd custom-domain list -g $rg --profile-name $afd --query "[].{name:name, host:hostName, validation:domainValidationState, cert:tlsSettings.certificateType}" -o tableaz afd origin-group list -g $rg --profile-name $afd --query "[].name" -o tsvaz afd origin list -g $rg --profile-name $afd --origin-group-name <origin-group> -o tableaz afd route list -g $rg --profile-name $afd --endpoint-name $ep --query "[].{route:name, og:originGroup.id, domains:customDomains[].id, paths:patternsToMatch}" -o json

az afd origin-group create -g $rg --profile-name $afd --origin-group-name og-<app> `  --probe-request-type HEAD --probe-protocol Https --probe-interval-in-seconds 60 --probe-path "/" `  --sample-size 4 --successful-samples-required 3 --additional-latency-in-milliseconds 50 $appHost = az webapp show -g <rg-app> -n <app> --query defaultHostName -o tsvaz afd origin create -g $rg --profile-name $afd --origin-group-name og-<app> --origin-name o-<app> `  --host-name $appHost --origin-host-header $appHost --http-port 80 --https-port 443 `  --priority 1 --weight 1000 --enabled-state Enabled

az network private-endpoint-connection list --id <app-id> --query "[?properties.privateLinkServiceConnectionState.status=='Pending'].id" -o tsvaz network private-endpoint-connection approve --id <connection-id> --description "Front Door"

# Certificate managed by Front Dooraz afd custom-domain create -g $rg --profile-name $afd --custom-domain-name app-company-tld --host-name app.company.tld `  --minimum-tls-version TLS12 --certificate-type ManagedCertificate # Or your own certificate from Key Vault (versionless = automatic renewal)$kvId = az keyvault show -n <keyvault-name> --query id -o tsvaz afd secret create -g $rg --profile-name $afd --secret-name sec-<certificate> `  --secret-source "$kvId/secrets/<certificate>" --use-latest-version trueaz afd custom-domain create -g $rg --profile-name $afd --custom-domain-name app-company-tld --host-name app.company.tld `  --minimum-tls-version TLS12 --certificate-type CustomerCertificate --secret sec-<certificate> # DNS recordsaz afd custom-domain show -g $rg --profile-name $afd --custom-domain-name app-company-tld --query "validationProperties.validationToken" -o tsv#   TXT   _dnsauth.app.company.tld  ->  <token>#   CNAME app.company.tld           ->  <endpoint-host>.azurefd.netaz afd custom-domain show -g $rg --profile-name $afd --custom-domain-name app-company-tld --query "{validation:domainValidationState, status:deploymentStatus}"

# New routeaz afd route create -g $rg --profile-name $afd --endpoint-name $ep --route-name rt-<app> `  --origin-group og-<app> --custom-domains app-company-tld --patterns-to-match "/*" `  --supported-protocols Http Https --https-redirect Enabled --forwarding-protocol HttpsOnly --link-to-default-domain Disabled # Add a domain to an EXISTING route – pass the existing domains too, otherwise they are removed!$cdId = az afd custom-domain show -g $rg --profile-name $afd --custom-domain-name app-company-tld --query id -o tsv$ids  = @(az afd route show -g $rg --profile-name $afd --endpoint-name $ep --route-name <route> --query "customDomains[].id" -o tsv) + $cdIdaz afd route update -g $rg --profile-name $afd --endpoint-name $ep --route-name <route> --custom-domains $ids

$fdId = az afd profile show -g $rg --profile-name $afd --query frontDoorId -o tsvaz webapp config access-restriction add -g <rg-app> -n <app> --rule-name AllowFrontDoor --priority 100 `  --action Allow --service-tag AzureFrontDoor.Backend --http-header x-azure-fdid=$fdId

az network front-door waf-policy create -g $rg -n wafafd<app> --sku Premium_AzureFrontDoor --mode Detectionaz network front-door waf-policy managed-rules add -g $rg --policy-name wafafd<app> --type Microsoft_DefaultRuleSet --version 2.1 --action Block$wafId = az network front-door waf-policy show -g $rg -n wafafd<app> --query id -o tsvaz afd security-policy create -g $rg --profile-name $afd --security-policy-name sp-<app> --waf-policy $wafId --domains $cdId

az afd endpoint purge -g $rg --profile-name $afd --endpoint-name $ep --content-paths "/*"curl.exe -sI https://app.company.tld                      # X-Azure-Ref, X-Cache in the responsecurl.exe -sI https://<endpoint-host>.azurefd.net          # test without the custom domain

az keyvault list -o tableaz keyvault show -n <kv> --query "{rbac:properties.enableRbacAuthorization, pna:properties.publicNetworkAccess, softDelete:properties.enableSoftDelete}"az keyvault secret list --vault-name <kv> -o tableaz keyvault secret show --vault-name <kv> -n <name> --query value -o tsvaz keyvault secret set  --vault-name <kv> -n <name> --value <value>az keyvault secret set  --vault-name <kv> -n <name> --file <file>           # value from a fileaz keyvault secret delete --vault-name <kv> -n <name>az keyvault secret list-deleted --vault-name <kv> -o tableaz keyvault secret recover --vault-name <kv> -n <name>                      # undo soft deleteaz keyvault certificate list --vault-name <kv> -o tableaz keyvault certificate import --vault-name <kv> -n <name> -f .\cert.pfx --password <pfx-password>az keyvault certificate show --vault-name <kv> -n <name> --query "{sid:sid, expires:attributes.expires}"# versionless secret ID: https://<kv>.vault.azure.net/secrets/<name>az keyvault certificate download --vault-name <kv> -n <name> -f cert.pem   # public part onlyaz keyvault list-deleted -o tableaz keyvault purge -n <kv>                                                   # delete permanently (careful!)az keyvault update -n <kv> --bypass AzureServices                           # allow trusted servicesaz keyvault network-rule add -n <kv> --ip-address <ip>/32az keyvault network-rule list -n <kv>

az keyvault create -n <keyvault-name> -g <rg> -l <region> --sku standard `  --enable-rbac-authorization true --enable-purge-protection true --retention-days 90 --public-network-access Enabled$kvId = az keyvault show -n <keyvault-name> --query id -o tsv$me   = az ad signed-in-user show --query id -o tsvaz role assignment create --assignee-object-id $me --assignee-principal-type User --role "Key Vault Administrator" --scope $kvId

# Self-signed (test) – PowerShell$policy = New-AzKeyVaultCertificatePolicy -SubjectName "CN=<fqdn>" -DnsName "<fqdn>" -IssuerName Self `  -ValidityInMonths 12 -SecretContentType "application/x-pkcs12" -KeyType RSA -KeySize 2048Add-AzKeyVaultCertificate -VaultName <keyvault-name> -Name <certificate-name> -CertificatePolicy $policyGet-AzKeyVaultCertificateOperation -VaultName <keyvault-name> -Name <certificate-name>      # status # For your own CA: IssuerName Unknown -> get CSR -> have it signed -> mergeaz keyvault certificate pending show  --vault-name <keyvault-name> -n <certificate-name> --query csr -o tsvaz keyvault certificate pending merge --vault-name <keyvault-name> -n <certificate-name> --file .\signed.cer

az identity list -g <rg> -o tableaz identity create -g <rg> -n <identity>az identity show -g <rg> -n <identity> --query "{principal:principalId, client:clientId, id:id}"az vm identity show -g <rg> -n <vm>az webapp identity assign -g <rg> -n <app> --identities <identity-id>

az role assignment list --assignee <principal-id-or-upn> --all -o tableaz role assignment list --scope <resource-id> --include-inherited -o tableaz role assignment create --assignee-object-id <principal-id> --assignee-principal-type ServicePrincipal `  --role "<role>" --scope <resource-id>az role assignment delete --assignee <principal-id> --role "<role>" --scope <resource-id>az role definition list --name "<role>" -o jsonaz role definition list --custom-role-only true -o tableaz ad signed-in-user show --query id -o tsv           # your own object ID # Service principal by display name -> object ID -> role$id = az ad sp list --display-name "<sp-name>" --query "[].{id:id}" --output tsvaz role assignment create --assignee-principal-type ServicePrincipal --assignee-object-id $id --scope "/subscriptions/<sub>" --role "Owner" # Scopes#   /subscriptions/<sub>/resourceGroups/<rg>                      resource group#   /subscriptions/<sub>                                          subscription#   /providers/Microsoft.Management/managementGroups/<mg-id>      management group#   /                                                             tenant root (everything – only with elevated access)az rest --method post --url "/providers/Microsoft.Authorization/elevateAccess?api-version=2016-07-01"   # Global Admin: get UAA on "/"az account management-group list -o table                    # management groups

az ad user show --id <upn> --query "{id:id, name:displayName}"az ad group list --display-name <part> -o tableaz ad group member list -g <group> --query "[].userPrincipalName" -o tsvaz ad group member check -g <group> --member-id <object-id>az ad sp list --display-name <name> -o tableaz ad sp show --id <app-id> --query "{objectId:id, appId:appId}"az ad app list --display-name <name> -o tableaz ad app credential list --id <app-id> --query "[].{end:endDateTime, name:displayName}" -o table   # secret expiryaz ad sp create-for-rbac -n <name> --role Contributor --scopes /subscriptions/<sub>

az policy assignment list --scope /subscriptions/<sub> -o tableaz policy assignment list --disable-scope-strict-match --scope /subscriptions/<sub>/resourceGroups/<rg> -o tableaz policy assignment show -n <assignment> --scope <scope>az policy definition show -n <definition-name> --query "{name:displayName, effect:policyRule.then.effect}"az policy state list --resource <resource-id> --query "[].{policy:policyDefinitionName, compliant:complianceState}" -o tableaz policy state summarize -g <rg>az policy state trigger-scan -g <rg> --no-wait                    # re-evaluate complianceaz policy exemption list --scope <scope> -o tableaz policy exemption create -n <name> --policy-assignment <assignment-id> --scope <scope> --exemption-category Waiver

Install-Module Az -Scope CurrentUser -Repository PSGalleryUpdate-Module AzConnect-AzAccount [-Tenant <id>] [-UseDeviceAuthentication]Connect-AzAccount -Identity                                # managed identityConnect-AzAccount -UseDeviceAuthentication                 # device code$cred = Get-Credential -UserName <app-id> ; Connect-AzAccount -ServicePrincipal -Credential $cred -Tenant <tenant-id>Get-AzContextGet-AzSubscriptionSet-AzContext -Subscription <name-or-id>Disconnect-AzAccount

Get-AzResourceGroup | Format-Table ResourceGroupName, LocationGet-AzResource -ResourceGroupName <rg> | Format-Table Name, ResourceTypeGet-AzResource -Name "*<part>*" | Format-Table Name, ResourceGroupName, ResourceTypeSearch-AzGraph -Query "Resources | where name contains '<part>' | project name, type, resourceGroup"   # module Az.ResourceGraph

Get-AzVM -Status | Select Name, ResourceGroupName, PowerStateStart-AzVM -ResourceGroupName <rg> -Name <vm>Stop-AzVM  -ResourceGroupName <rg> -Name <vm> -Force          # deallocatedInvoke-AzVMRunCommand -ResourceGroupName <rg> -VMName <vm> -CommandId RunPowerShellScript -ScriptString "ipconfig /all"

Get-AzVirtualNetwork | Select Name, @{n='Space';e={$_.AddressSpace.AddressPrefixes}}Get-AzVirtualNetworkPeering -ResourceGroupName <rg> -VirtualNetworkName <vnet> | Select Name, PeeringState, AllowForwardedTrafficGet-AzEffectiveRouteTable -ResourceGroupName <rg> -NetworkInterfaceName <nic> | Format-TableGet-AzEffectiveNetworkSecurityGroup -ResourceGroupName <rg> -NetworkInterfaceName <nic>Get-AzNetworkSecurityGroup -Name <nsg> -ResourceGroupName <rg> | Get-AzNetworkSecurityRuleConfig | Format-TableGet-AzPublicIpAddress | Select Name, IpAddressGet-AzApplicationGatewayBackendHealth -ResourceGroupName <rg> -Name <agw>

$AppGW = Get-AzApplicationGateway -Name <agw> -ResourceGroupName <rg>$AppGW.SslCertificates | Select Name, KeyVaultSecretId$AppGW.HttpListeners   | Select Name, Protocol, HostNames$secret   = Get-AzKeyVaultSecret -VaultName <kv> -Name <name>$secretId = $secret.Id.Replace($secret.Version, "")          # versionless secret ID$AppGW = Add-AzApplicationGatewaySslCertificate -ApplicationGateway $AppGW -Name <name> -KeyVaultSecretId $secretId$AppGW = Set-AzApplicationGatewaySslCertificate -ApplicationGateway $AppGW -Name <name> -KeyVaultSecretId <new-id>$AppGW = Remove-AzApplicationGatewaySslCertificate -ApplicationGateway $AppGW -Name <name>Set-AzApplicationGateway -ApplicationGateway $AppGW         # changes only take effect hereStop-AzApplicationGateway -ApplicationGateway $AppGW ; Start-AzApplicationGateway -ApplicationGateway $AppGW

Get-AzRoleAssignment -SignInName <upn>Get-AzRoleAssignment -Scope <resource-id>New-AzRoleAssignment -ObjectId <id> -RoleDefinitionName "<role>" -Scope <resource-id>Get-AzKeyVaultSecret -VaultName <kv> -Name <name> -AsPlainText

$vnet = Get-AzVirtualNetwork -ResourceGroupName <rg> -Name <vnet>Add-AzVirtualNetworkSubnetConfig -VirtualNetwork $vnet -Name <snet> -AddressPrefix 10.0.5.0/24 | Out-Null$vnet | Set-AzVirtualNetwork                         # only now is it changed in Azure

az extension add -n resource-graphaz graph query -q "<query>" --first 1000 -o tableaz graph query -q "<query>" --management-groups <mg-id> -o table        # only below one management groupaz graph query -q "<query>" --subscriptions <sub-id> -o table # Long queries: into a variable (PowerShell here-string)$q = @"Resources| where type =~ 'microsoft.compute/virtualmachines'| project name, resourceGroup"@az graph query -q $q -o table # Result as CSVaz graph query -q $q --first 1000 --query data -o json | ConvertFrom-Json | Export-Csv .\result.csv -NoTypeInformation -Encoding UTF8 # PowerShell moduleSearch-AzGraph -Query $q -First 1000 | Format-Table

// Count per resource typeResources | summarize Count = count() by type | order by Count desc // All VMs with size and stateResources| where type =~ 'microsoft.compute/virtualmachines'| project name, resourceGroup, subscriptionId, location,          size = tostring(properties.hardwareProfile.vmSize),          state = tostring(properties.extended.instanceView.powerState.code),          zone = tostring(zones[0]) // Resources per subscription with the subscription nameResources| join kind=inner (ResourceContainers | where type =~ 'microsoft.resources/subscriptions' | project subscriptionId, subName = name) on subscriptionId| summarize Count = count() by subName // Application gateways with SKU and stateResources| where type =~ 'microsoft.network/applicationgateways'| project name, resourceGroup, sku = tostring(properties.sku.name), state = tostring(properties.operationalState) // Key vaults with network accessResources| where type =~ 'microsoft.keyvault/vaults'| project name, resourceGroup, rbac = properties.enableRbacAuthorization, publicAccess = tostring(properties.publicNetworkAccess)

// VNets with address space and number of peeringsResources| where type =~ 'microsoft.network/virtualnetworks'| project name, resourceGroup, space = properties.addressSpace.addressPrefixes,          peerings = array_length(properties.virtualNetworkPeerings) // All subnets with NSG and route tableResources| where type =~ 'microsoft.network/virtualnetworks'| mv-expand s = properties.subnets| project vnet = name, subnet = tostring(s.name), prefix = tostring(s.properties.addressPrefix),          nsg = tostring(split(s.properties.networkSecurityGroup.id, '/')[8]),          routeTable = tostring(split(s.properties.routeTable.id, '/')[8]) // Subnets WITHOUT an NSGResources| where type =~ 'microsoft.network/virtualnetworks'| mv-expand s = properties.subnets| where isnull(s.properties.networkSecurityGroup)  and tostring(s.name) !in ('GatewaySubnet', 'AzureFirewallSubnet', 'AzureBastionSubnet', 'RouteServerSubnet')| project vnet = name, subnet = tostring(s.name), resourceGroup // Peerings that are not connectedResources| where type =~ 'microsoft.network/virtualnetworks'| mv-expand p = properties.virtualNetworkPeerings| where tostring(p.properties.peeringState) != 'Connected'| project vnet = name, peering = tostring(p.name), state = tostring(p.properties.peeringState) // All public IPs and what they are attached toResources| where type =~ 'microsoft.network/publicipaddresses'| project name, ip = tostring(properties.ipAddress), sku = tostring(sku.name),          attachedTo = tostring(split(properties.ipConfiguration.id, '/')[8]), resourceGroup // Private endpoints and their targetsResources| where type =~ 'microsoft.network/privateendpoints'| mv-expand c = properties.privateLinkServiceConnections| project name, resourceGroup,          target = tostring(split(c.properties.privateLinkServiceId, '/')[8]),          groupId = tostring(c.properties.groupIds[0]),          status = tostring(c.properties.privateLinkServiceConnectionState.status) // All routes with next hopResources| where type =~ 'microsoft.network/routetables'| mv-expand r = properties.routes| project routeTable = name, route = tostring(r.name), prefix = tostring(r.properties.addressPrefix),          nextHop = tostring(r.properties.nextHopType), ip = tostring(r.properties.nextHopIpAddress) // Who owns this private IP?Resources| where type =~ 'microsoft.network/networkinterfaces'| mv-expand ipc = properties.ipConfigurations| project nic = name, ip = tostring(ipc.properties.privateIPAddress),          vm = tostring(split(properties.virtualMachine.id, '/')[8]), resourceGroup| where ip == '<ip>'

// NSG rules that allow SSH/RDP/everything from the internetResources| where type =~ 'microsoft.network/networksecuritygroups'| mv-expand r = properties.securityRules| where r.properties.direction == 'Inbound' and r.properties.access == 'Allow'| where tostring(r.properties.sourceAddressPrefix) in ('*', 'Internet', '0.0.0.0/0')| where tostring(r.properties.destinationPortRange) in ('22', '3389', '*')| project nsg = name, rule = tostring(r.name), port = tostring(r.properties.destinationPortRange), resourceGroup // Storage accounts with public accessResources| where type =~ 'microsoft.storage/storageaccounts'| project name, resourceGroup, publicNetwork = tostring(properties.publicNetworkAccess),          blobPublic = properties.allowBlobPublicAccess, minTls = tostring(properties.minimumTlsVersion) // Open Defender recommendations per topicSecurityResources| where type == 'microsoft.security/assessments'| where properties.status.code == 'Unhealthy'| summarize Count = count() by recommendation = tostring(properties.displayName)| order by Count desc

// Disks without a VMResources| where type =~ 'microsoft.compute/disks' and properties.diskState =~ 'Unattached'| project name, resourceGroup, sizeGB = properties.diskSizeGB, sku = tostring(sku.name) // Unassigned public IPsResources| where type =~ 'microsoft.network/publicipaddresses'| where isnull(properties.ipConfiguration) and isnull(properties.natGateway)| project name, resourceGroup, ip = tostring(properties.ipAddress) // NICs without VM and without private endpointResources| where type =~ 'microsoft.network/networkinterfaces'| where isnull(properties.virtualMachine) and isnull(properties.privateEndpoint)| project name, resourceGroup // Stopped but not deallocated VMs (still cost money)Resources| where type =~ 'microsoft.compute/virtualmachines'| where properties.extended.instanceView.powerState.code == 'PowerState/stopped'| project name, resourceGroup // Empty resource groupsResourceContainers| where type =~ 'microsoft.resources/subscriptions/resourcegroups'| join kind=leftouter (Resources | summarize n = count() by resourceGroup, subscriptionId) on resourceGroup, subscriptionId| where isnull(n)| project resourceGroup, subscriptionId

// Resources without tag "Environment"Resources| where isnull(tags['Environment']) or tostring(tags['Environment']) == ''| project name, type, resourceGroup // Resource groups without ownerResourceContainers| where type =~ 'microsoft.resources/subscriptions/resourcegroups'| where isnull(tags['Owner'])| project name, subscriptionId // Values used for a tagResources| summarize Count = count() by env = tostring(tags['Environment'])

// What changed in the last 24 h?ResourceChanges| extend time = todatetime(properties.changeAttributes.timestamp),         kind = tostring(properties.changeType),         id = tostring(properties.targetResourceId)| where time > ago(1d)| project time, kind, id| order by time desc // Role assignments at subscription levelAuthorizationResources| where type =~ 'microsoft.authorization/roleassignments'| extend scope = tostring(properties.scope), principal = tostring(properties.principalId),         type = tostring(properties.principalType), role = tostring(split(properties.roleDefinitionId, '/')[-1])| where scope startswith '/subscriptions/' and scope !contains 'resourceGroups'| project scope, principal, type, role // Non-compliant resources per policyPolicyResources| where type =~ 'microsoft.policyinsights/policystates'| where properties.complianceState =~ 'NonCompliant'| summarize Count = count() by policy = tostring(properties.policyDefinitionName)| order by Count desc // Subscriptions with their management groupResourceContainers| where type =~ 'microsoft.resources/subscriptions'| project name, subscriptionId, mg = tostring(properties.managementGroupAncestorsChain[0].displayName)

az ad app list --display-name <name> --query "[].{name:displayName, appId:appId, objectId:id}" -o tableaz ad sp  list --display-name <name> --query "[].{name:displayName, appId:appId, spObjectId:id}" -o tableaz ad sp show --id <app-id> --query id -o tsv                # SP object ID from the app IDaz ad app owner list --id <app-id> --query "[].userPrincipalName" -o tsvaz ad app owner add  --id <app-id> --owner-object-id <user-object-id> # New app with SP and role (secret is shown ONCE – store it in Key Vault right away)az ad sp create-for-rbac -n <name> --role Contributor --scopes /subscriptions/<sub-id>

# One appaz ad app credential list --id <app-id> --query "[].{name:displayName, end:endDateTime, keyId:keyId}" -o tableaz ad app credential list --id <app-id> --cert --query "[].{name:displayName, end:endDateTime}" -o table # All apps whose secret expires within the next 30 days$limit = (Get-Date).AddDays(30)az ad app list --all --query "[].{name:displayName, appId:appId, secrets:passwordCredentials[].endDateTime}" -o json |  ConvertFrom-Json | ForEach-Object {    $app = $_    $app.secrets | Where-Object { $_ -and [datetime]$_ -lt $limit } |      ForEach-Object { [pscustomobject]@{ App = $app.name; AppId = $app.appId; Expires = ([datetime]$_).ToString('yyyy-MM-dd') } }  } | Sort-Object Expires | Format-Table

# Create the new secret IN ADDITION (--append), the old one stays valid for nowaz ad app credential reset --id <app-id> --append --display-name "secret-$(Get-Date -Format yyyyMM)" --years 1 --query password -o tsv# -> enter it right away in Key Vault / the service connection / pipeline variableaz keyvault secret set --vault-name <kv> -n <secret-name> --value "<new-secret>" # Once everything is switched over: delete the old secretaz ad app credential list   --id <app-id> -o tableaz ad app credential delete --id <app-id> --key-id <old-key-id>

az ad group list --display-name <part> --query "[].{name:displayName, id:id}" -o tableaz ad group create --display-name <name> --mail-nickname <name>az ad group member list  -g <group> --query "[].{name:displayName, upn:userPrincipalName}" -o tableaz ad group member add   -g <group> --member-id <object-id>az ad group member remove -g <group> --member-id <object-id>az ad group member check -g <group> --member-id <object-id> --query valueaz ad user get-member-groups --id <upn> --query "[].displayName" -o tsv     # a user's groups

# Azure Cloud Shell (PowerShell) or locally after Connect-AzAccount$groups = @(    @{ Name = "az-<customer>-owner";                    Desc = "<Customer> - Owner" }    @{ Name = "az-<customer>-contributor";              Desc = "<Customer> - Contributor" }    @{ Name = "az-<customer>-reader";                   Desc = "<Customer> - Reader" }    @{ Name = "az-<customer>-costmanagementreader";     Desc = "<Customer> - Cost Management Reader" }    @{ Name = "az-<customer>-landingzones-owner";       Desc = "<Customer> - Landing Zones Owner" }    @{ Name = "az-<customer>-landingzones-contributor"; Desc = "<Customer> - Landing Zones Contributor" }    @{ Name = "az-<customer>-landingzones-reader";      Desc = "<Customer> - Landing Zones Reader" }) foreach ($g in $groups) {    $existing = Get-AzADGroup -DisplayName $g.Name -ErrorAction SilentlyContinue    if ($existing) {        Write-Host "Already exists: $($g.Name) (Id: $($existing.Id))" -ForegroundColor Yellow        continue    }    try {        $new = New-AzADGroup -DisplayName $g.Name -MailNickname $g.Name -Description $g.Desc -SecurityEnabled -ErrorAction Stop        Write-Host "Created: $($g.Name) (Id: $($new.Id))" -ForegroundColor Green    }    catch {        Write-Host "Error for $($g.Name): $($_.Exception.Message)" -ForegroundColor Red    }} # OverviewGet-AzADGroup -Filter "startswith(displayName,'az-<customer>')" |    Select-Object DisplayName, Id, SecurityEnabled | Format-Table -AutoSize

az ad user show --id <upn> --query "{name:displayName, id:id, enabled:accountEnabled}"az ad user list --filter "startswith(displayName,'<part>')" --query "[].{name:displayName, upn:userPrincipalName}" -o tableaz ad user list --filter "userType eq 'Guest'" --query "[].{name:displayName, mail:mail}" -o table     # guests

$scope = "/subscriptions/<sub-id>"$me    = (Get-AzADUser -SignedIn).IdGet-AzRoleEligibilitySchedule -Scope $scope -Filter "asTarget()" |  Select-Object RoleDefinitionDisplayName, Scope, RoleDefinitionId          # what may I activate? $roleId = "<RoleDefinitionId from the list>"New-AzRoleAssignmentScheduleRequest -Name (New-Guid).Guid -Scope $scope `  -PrincipalId $me -RoleDefinitionId $roleId -RequestType SelfActivate `  -ScheduleInfoStartDateTime (Get-Date).ToUniversalTime().ToString("o") `  -ExpirationType AfterDuration -ExpirationDuration PT8H `  -Justification "<reason / ticket>"

Tenant Root Group  (/)└── <Company>    ├── Platform    │   ├── Identity        – domain controllers, Entra helper services    │   ├── Management      – Log Analytics, Automation, monitoring    │   └── Connectivity    – hub VNet, firewall/FortiGate, VPN, DNS    ├── Landing Zones    │   ├── Corp            – applications connected to the corporate network    │   └── Online          – applications directly from the internet    ├── Sandbox             – playground, no connectivity    └── Decommissioned      – retired subscriptions

az account management-group list -o tableaz account management-group show -n <mg-id> --expand --recurse `  --query "{name:displayName, children:children[].{name:displayName, type:type}}" -o jsonaz account management-group entities list --query "[].{name:displayName, type:type, parent:parent.id}" -o table   # everything flat

az graph query -q "ResourceContainers | where type =~ 'microsoft.resources/subscriptions' | project name, subscriptionId, mgChain = properties.managementGroupAncestorsChain" -o json

az account management-group subscription show-sub-under-mg -n <mg-id> -o table      # subscriptions under an MGaz account management-group subscription add --name <target-mg-id> --subscription <sub-id>

$mg = "/providers/Microsoft.Management/managementGroups/<mg-id>"az policy assignment list --scope $mg --query "[].{name:displayName, effect:parameters.effect.value, def:policyDefinitionId}" -o tableaz role assignment list --scope $mg --query "[].{who:principalName, role:roleDefinitionName}" -o table # Everything that affects a subscription (incl. inheritance from above)az policy assignment list --disable-scope-strict-match --scope /subscriptions/<sub-id> -o tableaz role assignment list --scope /subscriptions/<sub-id> --include-inherited -o table

az deployment mg what-if -m <mg-id> -l <region> -f main.bicep -p params/mg.bicepparamaz deployment mg create  -m <mg-id> -l <region> -f main.bicep -p params/mg.bicepparamaz deployment mg list -m <mg-id> -o tableaz deployment tenant create -l <region> -f tenant.bicep           # at the very top (needs permissions on "/")

az security secure-scores list --query "[].{name:displayName, current:score.current, max:score.max, percent:score.percentage}" -o tableaz security secure-score-controls list --query "[].{name:displayName, current:score.current, max:score.max, open:unhealthyResourceCount}" -o tableaz security assessment list --query "[?status.code=='Unhealthy'].{recommendation:displayName, resource:resourceDetails.Id}" -o table

az security pricing list --query "value[].{plan:name, tier:pricingTier}" -o tableaz security pricing show -n VirtualMachinesaz security pricing create -n KeyVaults --tier Standard          # enable a plan (costs money)

az security alert list --query "[].{time:timeGeneratedUtc, severity:severity, title:alertDisplayName, resource:compromisedEntity, status:status}" -o tableaz security alert update --location <region> -n <alert-name> -g <rg> --status Dismiss       # close after review

$vmId = (Get-AzVM -ResourceGroupName <rg> -Name <vm>).Id$myIp = Invoke-RestMethod https://api.ipify.org$req = @{ id = $vmId; ports = @(@{ number = 22; endTimeUtc = (Get-Date).ToUniversalTime().AddHours(3).ToString("o"); allowedSourceAddressPrefix = @($myIp) }) }Start-AzJitNetworkAccessPolicy -ResourceGroupName <rg> -Location <region> -Name default -VirtualMachine @($req)

$sub = "<sub-id>"az account set --subscription $subaz security secure-scores list --query "[0].score.percentage" -o tsv                   # secure score in %az security pricing list --query "value[?pricingTier=='Free'].name" -o tsv              # plans that are offaz graph query --subscriptions $sub -q "Resources | where type =~ 'microsoft.network/networksecuritygroups' | mv-expand r = properties.securityRules | where r.properties.access == 'Allow' and r.properties.direction == 'Inbound' and tostring(r.properties.sourceAddressPrefix) in ('*','Internet') | project name, rule = tostring(r.name), port = tostring(r.properties.destinationPortRange)" -o tableaz graph query --subscriptions $sub -q "Resources | where type =~ 'microsoft.storage/storageaccounts' and properties.allowBlobPublicAccess == true | project name" -o tableaz keyvault list -o json | ConvertFrom-Json | Where-Object { -not $_.properties.enablePurgeProtection } | ForEach-Object name   # vaults without purge protection

azcopy login --tenant-id <tenant-id>                                   # sign in with Entra IDazcopy copy ".\folder" "https://<sa>.blob.core.windows.net/<container>/" --recursiveazcopy copy "https://<sa>.blob.core.windows.net/<container>/path/*" ".\target" --recursiveazcopy sync ".\folder" "https://<sa>.blob.core.windows.net/<container>/folder" --delete-destination=false   # changes onlyazcopy copy "https://<sa-a>.blob.core.windows.net/<c>/?<sas>" "https://<sa-b>.blob.core.windows.net/<c>/?<sas>" --recursive   # account to accountazcopy list "https://<sa>.blob.core.windows.net/<container>"azcopy jobs list ; azcopy jobs resume <job-id>                         # resume an aborted transfer

# User delegation SAS (with Entra sign-in, without account key – preferred)$expiry = (Get-Date).ToUniversalTime().AddHours(8).ToString("yyyy-MM-ddTHH:mmZ")$sas = az storage container generate-sas --account-name <sa> -n <container> `  --permissions rl --expiry $expiry --auth-mode login --as-user -o tsv"https://<sa>.blob.core.windows.net/<container>?$sas" # For a single blobaz storage blob generate-sas --account-name <sa> -c <container> -n <file> `  --permissions r --expiry $expiry --auth-mode login --as-user --full-uri -o tsv

# Show and restore deleted blobs (soft delete must be on)az storage blob list --account-name <sa> -c <container> --include d --auth-mode login `  --query "[?deleted].{name:name, deleted:properties.deletedTime}" -o tableaz storage blob undelete --account-name <sa> -c <container> -n <file> --auth-mode login # Versions of a blob (versioning must be on)az storage blob list --account-name <sa> -c <container> --prefix <file> --include v --auth-mode login `  --query "[].{name:name, version:versionId, current:isCurrentVersion}" -o table# Make an old version the current one againaz storage blob copy start --account-name <sa> --destination-container <container> --destination-blob <file> `  --source-uri "https://<sa>.blob.core.windows.net/<container>/<file>?versionid=<version-id>" --auth-mode login # Restore a deleted containeraz storage container list --account-name <sa> --include-deleted --auth-mode login --query "[?deleted]" -o tableaz storage container restore --account-name <sa> -n <container> --deleted-version <version> --auth-mode login

az storage account blob-service-properties update -g <rg> --account-name <sa> `  --enable-delete-retention true --delete-retention-days 14 `  --enable-container-delete-retention true --container-delete-retention-days 14 `  --enable-versioning trueaz storage account update -g <rg> -n <sa> --allow-blob-public-access false --min-tls-version TLS1_2az storage account update -g <rg> -n <sa> --allow-shared-key-access false     # Entra sign-in only (check first who uses keys!)az lock create -n lock-<sa> -g <rg> --resource-type Microsoft.Storage/storageAccounts --resource <sa> --lock-type CanNotDelete

az storage share-rm list -g <rg> --storage-account <sa> -o tableaz storage share-rm create -g <rg> --storage-account <sa> -n <share> --quota 100# Windows: test the connection and map a drive (port 445 must be open)Test-NetConnection <sa>.file.core.windows.net -Port 445net use Z: \\<sa>.file.core.windows.net\<share> /user:localhost\<sa> <storage-key>

{  "rules": [{    "name": "cleanup-logs",    "enabled": true,    "type": "Lifecycle",    "definition": {      "filters": { "blobTypes": [ "blockBlob" ], "prefixMatch": [ "logs/" ] },      "actions": {        "baseBlob": {          "tierToCool": { "daysAfterModificationGreaterThan": 30 },          "delete":     { "daysAfterModificationGreaterThan": 365 }        }      }    }  }]}

az storage account management-policy create -g <rg> --account-name <sa> --policy "@policy.json"az storage account management-policy show   -g <rg> --account-name <sa>

$rg = "<rg-monitoring>"az monitor action-group create -g $rg -n ag-net-team --short-name netteam `  --action email team <team@company.tld>az monitor action-group update -g $rg -n ag-net-team --add-action email oncall <oncall@company.tld>az monitor action-group update -g $rg -n ag-net-team --add-action webhook teams "<teams-workflow-url>"az monitor action-group show -g $rg -n ag-net-team --query id -o tsv

$ag = az monitor action-group show -g <rg-monitoring> -n ag-net-team --query id -o tsv # VM not available$vmId = az vm show -g <rg> -n <vm> --query id -o tsvaz monitor metrics alert create -g <rg-monitoring> -n "vm-<vm>-down" --scopes $vmId `  --condition "avg VmAvailabilityMetric < 1" --window-size 5m --evaluation-frequency 1m `  --severity 1 --action $ag --description "VM <vm> not available" # VM CPU constantly highaz monitor metrics alert create -g <rg-monitoring> -n "vm-<vm>-cpu" --scopes $vmId `  --condition "avg Percentage CPU > 90" --window-size 15m --evaluation-frequency 5m --severity 2 --action $ag # App Gateway: backend unhealthy$agwId = az network application-gateway show -g <rg> -n <agw> --query id -o tsvaz monitor metrics alert create -g <rg-monitoring> -n "agw-<agw>-unhealthy" --scopes $agwId `  --condition "max UnhealthyHostCount > 0" --window-size 5m --evaluation-frequency 1m --severity 1 --action $ag # Load balancer: health probe fails (e.g. FortiGate ILB)$lbId = az network lb show -g <rg> -n <lb> --query id -o tsvaz monitor metrics alert create -g <rg-monitoring> -n "lb-<lb>-probe" --scopes $lbId `  --condition "avg DipAvailability < 100" --window-size 5m --evaluation-frequency 1m --severity 2 --action $ag # VPN tunnel down$conId = az network vpn-connection show -g <rg> -n <conn> --query id -o tsvaz monitor metrics alert create -g <rg-monitoring> -n "vpn-<conn>-down" --scopes $conId `  --condition "max TunnelIngressBytes < 1" --window-size 15m --evaluation-frequency 5m --severity 2 --action $ag

$ag = az monitor action-group show -g <rg-monitoring> -n ag-net-team --query id -o tsv$sub = "/subscriptions/<sub-id>" # Route changed (FortiGate failover via SDN connector, or someone touched a UDR)az monitor activity-log alert create -g <rg-monitoring> -n "route-changed" --scope $sub `  --condition category=Administrative and operationName=Microsoft.Network/routeTables/routes/write `  --action-group $ag # NSG rule changedaz monitor activity-log alert create -g <rg-monitoring> -n "nsg-rule-changed" --scope $sub `  --condition category=Administrative and operationName=Microsoft.Network/networkSecurityGroups/securityRules/write `  --action-group $ag # Service Health (Microsoft outages)az monitor activity-log alert create -g <rg-monitoring> -n "service-health" --scope $sub `  --condition category=ServiceHealth --action-group $ag

// FortiGate reports an HA change (Syslog/CEF)CommonSecurityLog| where DeviceVendor == "Fortinet"| where Activity has "HA" and (Activity has "state" or Message has "failover") // WAF suddenly blocks a lot (> 100 in 5 min)AzureDiagnostics| where Category == "ApplicationGatewayFirewallLog" and action_s == "Blocked"| summarize Count = count() by bin(TimeGenerated, 5m)| where Count > 100 // VM no longer sends a heartbeatHeartbeat| summarize last = max(TimeGenerated) by Computer| where last < ago(10m)

az resource show --ids <resource-id>/providers/Microsoft.ResourceHealth/availabilityStatuses/current `  --api-version 2022-10-01 --query "properties.{status:availabilityState, reason:summary}"az monitor activity-log alert create -g <rg-monitoring> -n "resource-health" --scope /subscriptions/<sub-id> `  --condition category=ResourceHealth --action-group $ag

az monitor metrics alert list -g <rg-monitoring> --query "[].{name:name, enabled:enabled, severity:severity}" -o tableaz monitor activity-log alert list -g <rg-monitoring> -o tableaz monitor metrics alert update -g <rg-monitoring> -n <alert> --enabled false        # temporarily off (maintenance)az monitor alert-processing-rule create -g <rg-monitoring> -n maintenance-<date> `  --scopes /subscriptions/<sub-id>/resourceGroups/<rg> --rule-type RemoveAllActionGroups `  --schedule-start-datetime "2026-11-01 22:00:00" --schedule-end-datetime "2026-11-02 02:00:00" --schedule-time-zone "W. Europe Standard Time"

az extension add -n costmanagement# Costs of the current month per resource groupaz costmanagement query --type ActualCost --timeframe MonthToDate --scope "/subscriptions/<sub-id>" `  --dataset-aggregation '{\"totalCost\":{\"name\":\"Cost\",\"function\":\"Sum\"}}' `  --dataset-grouping name="ResourceGroupName" type="Dimension" -o json

az consumption budget create --budget-name budget-<rg> --resource-group <rg> `  --amount 500 --category cost --time-grain monthly `  --start-date 2026-11-01 --end-date 2027-10-31az consumption budget list -o table

az advisor recommendation list --category Cost `  --query "[].{recommendation:shortDescription.problem, resource:impactedValue, impact:impact}" -o tableaz advisor recommendation list --category Cost --query "[?contains(shortDescription.problem,'Right-size')]" -o table

az extension add -n resource-graph# 1. Findaz graph query -q "Resources | where type =~ 'microsoft.compute/disks' and properties.diskState =~ 'Unattached' | project id, name, resourceGroup, sizeGB = properties.diskSizeGB" -o tableaz graph query -q "Resources | where type =~ 'microsoft.network/publicipaddresses' and isnull(properties.ipConfiguration) and isnull(properties.natGateway) | project id, name, resourceGroup" -o tableaz graph query -q "Resources | where type =~ 'microsoft.network/networkinterfaces' and isnull(properties.virtualMachine) and isnull(properties.privateEndpoint) | project id, name, resourceGroup" -o table # 2. Check (tags, owner, who created it?)az resource show --ids <id> --query "{tags:tags, created:createdTime}"az monitor activity-log list --resource-id <id> --offset 90d --query "[?contains(operationName.value,'write')].{time:eventTimestamp, who:caller}" -o table # 3. Mark first, delete lateraz resource tag --ids <id> --tags DeleteAfter=2026-12-01 Reason=orphaned -iaz resource delete --ids <id>                     # after consultation / when the deadline has passed